/// <reference path="../../typings-recipe.d.ts" />
/*
 * Configure SSH server and client
 */
"use strict";
function getSSHConfigFile(name) {
    return $file.exists(`/etc/ssh/${name}`) ? `/etc/ssh/${name}` : `/etc/${name}`;
}
recipes.register({
    id: "ssh-settings",
    on: { provisionMachine: { depends: ["system-packages"] } },
    conditions: {
        platformTags: { any: ["linux"] },
    },
    recipeHandler: input => {
        const sshdConfigFile = getSSHConfigFile("sshd_config");
        const sshConfigfile = getSSHConfigFile("ssh_config");
        const clientAliveIntervalText = "\nClientAliveInterval 180\n";
        const excludedCiphers = ["arcfour"];
        const enabledCiphers = [
            "aes128-ctr", "aes192-ctr", "aes256-ctr",
            "aes128-gcm@openssh.com", "aes256-gcm@openssh.com",
            "chacha20-poly1305@openssh.com",
        ];
        // remove existing parameters
        $file.substitute(sshdConfigFile, [
            { pattern: new RegExp("(ClientAliveInterval\\s)"), value: "#$1" },
            { pattern: new RegExp("(Ciphers\\s)"), value: "#$1" },
        ], {
            multiline: false
        });
        // add ClientAliveInterval setting
        $file.append(sshdConfigFile, clientAliveIntervalText);
        // configure UseReoaming no for all hosts
        $file.append(sshConfigfile, "\nHost *\n    UseRoaming no\n");
        // configure ciphers
        const availableCiphers = $os.runProgram("ssh", [
            "-Q", "cipher"
        ]).split(/[\s,]+/).filter(cipher => {
            return ((cipher.length > 0) && (excludedCiphers.indexOf(cipher) < 0));
        });
        // detect ciphers that are not in the allowed list
        const unknownCiphers = availableCiphers.filter(cipher => {
            return (enabledCiphers.indexOf(cipher) < 0);
        });
        if (unknownCiphers.length > 0) {
            throw new Error(`Unknown SSH cipher(s): ${unknownCiphers.join(" ")}`);
        }
        let resultCiphers = enabledCiphers.filter(cipher => {
            return (availableCiphers.indexOf(cipher) >= 0);
        });
        $file.append(sshdConfigFile, `\nCiphers ${resultCiphers.join(",")}\n`);
    }
});
recipes.register({
    id: "ssh-settings-password",
    on: { provisionMachine: { depends: ["system-packages", "ssh-settings"] } },
    conditions: {
        platformTags: { any: ["linux"] },
        cloudTags: { not: { any: ["azure"] } }
    },
    recipeHandler: input => {
        const sshdConfigFile = getSSHConfigFile("sshd_config");
        const passwordAuthenticationText = "\nPasswordAuthentication no\n";
        // remove existing parameters
        $file.substitute(sshdConfigFile, [
            { pattern: new RegExp("(^|\\vn)\\s*(PasswordAuthentication\\s[A-Za-z]+)"), value: "" },
        ], {
            multiline: true
        });
        // add ClientAliveInterval setting
        $file.append(sshdConfigFile, passwordAuthenticationText);
    }
});